gmgn-kline-pattern
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the gmgn-cli command-line utility for data retrieval. This tool is consistent with the vendor name (gmgnai) and the skill's stated purpose of analyzing market data.
- [PROMPT_INJECTION]: The instructions include a mandatory validation step for user-supplied token addresses (checking for EVM hex formats and Solana base58 formats) before they are used in shell commands. This is a security best practice that prevents command injection via malformed user input.
- [INDIRECT_PROMPT_INJECTION]: The skill includes defensive instructions for handling external data, specifically directing the agent to treat text fields in the JSON response (such as 'source') strictly as data and never as instructions. This mitigates risks associated with data-borne prompt injection.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of gmgn-cli via npm. As this is the official tool of the skill's authoring organization (gmgnai), it is classified as a standard and safe dependency for the intended functionality.
Audit Metadata